Quantum Byzantine Agreement with a Single Qutrit 
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Quantum mechanics provides several methods to generate and securely distribute private lists of 
numbers suitably correlated to solve the Three Byzantine Generals Problem. So far, these methods 
are based on three-qutrit singlet states, four-qubit entangled states, and three or two pairwise 
quantum key distribution channels. Here we show that the problem can be solved using a single 
qutrit. This scheme presents some advantages over previous schemes, and emphasizes the specific 
role of qutrits in basic quantum information processing. 

PACS numbers: 03.67.Hk, 03.67.-a, 03.67.Dd 



43 

c ■ 

=5 

cr 



> 



O 

o 



X 



It has been recently shown that optimal quantum solu- 
tions for some multiparty communication tasks do not re- 
quire entanglement. Protocols using only the sequential 
communication of a single qubit have been demonstrated 
for secret sharing [l[ and some communication complex- 
ity problems [H . These protocols were shown to be much 
more resistant to noise and imperfections than previous 
protocols based on entanglement. Here we shall present 
a new example of a problem which can find an optimal 
quantum solution in the form of a sequential exchange of 
a single quantum system. 

The Three Byzantine Generals Problem (TBGP) ex- 
presses abstractly the problem of achieving coordination 
between the nonfaulty components of a distributed com- 
putation when some components fail 0, 0] ■ Three divi- 
sions of the Byzantine army, each commanded by its own 
general, are besieging an enemy city. The three generals, 
Alexander, Buonaparte, and Clausevitz (A, B, and C) 
can communicate with one another by messenger only 
(i.e., by pairwise authenticated error- free classical chan- 
nels) . They must decide upon a common plan of action: 
either to attack (0) or to retreat (1). The commanding 
general A decides on a plan and communicates this plan 
to the other two generals by sending B a message vtlab 
(either or 1), and by sending C a message ttlac- Then, 
B communicates the plan to C by sending him a message 
niBC, and C communicates the plan to B by sending him 
a message mcB- However, one of the generals (including 
A) might be a traitor, trying to keep the loyal generals 
from agreeing on a plan. The TBGP is to find a way 
in which: (i) all loyal generals follow the same plan, and 
(ii) if A is loyal, then every loyal general follows the plan 
decided by A. 

The TBGP is unsolvable [H, 0], unless the generals 
share some suitable private data. Each of the generals 



must be in possession of a list of numbers unknown to 
the other generals, but suitably correlated with the corre- 
sponding lists of the other generals. There is no method, 
neither classical nor quantum, to guarantee the success 
of the distribution of the required lists. Nevertheless, 
a variation of the TBGP, called Detectable Byzantine 
Agreement (DBA) or Detectable Broadcast [H, [a] , which 
is unsolvable by classical means Q, can be solved using 
quantum resources [El 15. 154121] . In the DBA, conditions 
(i) and (ii) are relaxed so (i') either all loyal generals fol- 
low the same plan or all abort, and (ii') if A is loyal, then 
either every loyal general follows the plan decided by A 
or aborts. 

Quantum mechanics provides several methods to gen- 
erate and securely distribute the required lists. So far, 
these methods are based on three-qutrit singlet states 
E B I3> four-qubit entangled states [l(J 12 1 , and three 



or two 



11| pairwise quantum key distribution (QKD) 



channels. In this Letter we introduce a protocol to gen- 
erate and securely distribute these lists using a single 
qutrit. We assume that A, B, and C can communicate 
with one another by pairwise authenticated error-free 
classical channels and pairwise authenticated quantum 
channels. 

Correlated lists and their use. — The goal of the proto- 
col is to distribute three lists, I a known only by A, Ib 
known only by B, and lc known only by C, all of the 
same length L, with the property that if (1) is at po- 
sition j in I a, then (1) is at position j both in lg and 
in lc, and if 2 is at position j in I a, then is at posi- 
tion j in one of the other lists and 1 is at position j in 
the other. The combinations 201 and 210 occur with the 
same probability ljl 12| . 

Before we proceed further, note that, on one hand, 
A knows exactly at which positions the lists I a and Ib 
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TABLE I: At the beginning of step (ii), C has received ttiac in the form of Iac from A, and tubc in the form of Ibc from 
B. The table shows what C will do, depending on what C obtains when he checks the consistency between these data and his 
own list lc- {mAG,lAc} — lc means that tuac and Iac are found to be consistent with lc, ^ means "inconsistent with," and 
_L means "I have received inconsistent data." 





If 


then C will follow the plan 


(iia) 


{m A C,lAc} = Id: 


£ {nine, Ibc} — lc &£ tuac = mac 


rriAC = rn-BC ( no traitor) 


(iib) 


{rriAC, Iac} = lc i 


£ {m B c, Ibc} — lc & rriAC / m B c 


previously decided by B and C (A is the traitor) 


(he) 


{m A c,lAc} = hi: 


£ rriBC = -L 


rriAC (although A can be the traitor) 


(iid) 


{ttiacIac} = hi 


z {m B c, Ibc} ¥ lc 


rriAC (B is the traitor) 


(he) 


{tuacIac} ¥ Id 


£ {m B c, Ibc} — lc 


rase (A is the traitor) 


(iif) 


{tuacIac} ¥ lei 


£ rriBC = -L 


previously decided by B and C (A is the traitor) 



are perfectly correlated, and at which positions they are 
anticorrelated (but in this case he has no faintest idea 
who has 1 and who has 0). On the other hand, B and C 
do not know whether their data at a given position are 
correlated or anticorrelated. 

Once the parties have these lists, they can use them 
to reach an agreement following a protocol introduced in 
[l2| and summarized here for completeness' sake: 

(i) When A wants to send 73 a message ttiab (attack, 1, 
or retreat, 0) he sends B a list Iab of all of the positions 
in I a in which the value ttiab appears. After that, if A 
is loyal he will follow his plan of military action. 

The roles of B and C are symmetrical, and thus ev- 
erything we say about B applies to C and vice versa. 
When B receives tttab hi the form of Iab-, only one of 
two things are allowed to happen: 

(ia) If Iab is of the appropriate length (i.e., approx- 
imately L/3), and Iab, and Is are consistent at each 
position j (i.e. they fulfill the property of the lists), then 
B will follow the plan ttiab implied by the received Iab 
unless C convinces him that A is the traitor in the next 
step [see (ii)]. 

(ib) If Iab and Is are inconsistent, then B ascertains 
that A is the traitor and B will not follow any plan until 
he reaches an agreement with C in the next step [see (ii)]. 

(ii) The message ttibc B sends C can be not only 
or 1, but also _L, meaning "I have received inconsistent 
data." If the message to be conveyed, ttiac is or 1, B 
sends C a list Ibc which is, if he is loyal and so is A, 
the same list Iab that B has received from A. After C 
receives tttbc in the form of Ibc, he compares it with 
ttiac received earlier in the form of Iac- Then, only one 
of six situations can happen, which are listed in the Table 

IB 

Quantum distribution of the lists. — Now we shall ex- 
plain the quantum protocol for distributing these lists. 
The three generals have devices which can unitarily 
transform qutrits. In addition, general A has also a 
source of qutrits and general C has a detection station. 
The three generals act according to the following proto- 
col. 



(I) Initial state. A prepares his qutrit in the state 

|^ ) = -L(|0> + |1) + |2)). (1) 

(II) A sets the basis. His first choice is the "basis 
choice" , which is to decide whether he will be coding his 
number in the basis 7, in which case he does not perform 
any initial unitary transformation, or in the basis 77, in 
which case he acts with a unitary operator 



(2) 



Note that, from the interferometric point of view, the 
type 77 operation has no effects on the beam and in- 
troduces a phase shift by 2ir/3 in the beams 1 and 2. 

(Ill) A encodes the number. The next choice of A is to 
encode one of the three random numbers 0, 1, and 2 (all 
with the same probability). If he wants to encode n, he 
performs 
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-i 2n7r/3 



(3) 



After that, the qutrit is sent to general B. 

(IV) B chooses the basis. B either performs Uu (type 
77 basis encoding) or does nothing (type I). 

(V) B encodes the number. B is allowed to encode 
or 1 with equal probabilities. If he is to encode 0, he 
does nothing, that is t/(0), in the other case he acts with 
U(l). He then sends the qutrit to general C. 

(VI) C chooses the basis and encodes the number in 
exactly the same way as B. 

(VII) C measures the qutrit using a device that distin- 
guishes the state \tpo) given by (P) from any two other 
states orthogonal to it, e.g., an unbiased multiport beam- 
splitter. 

(VIII) If C gets l^o), the generals reveal their bases, 
but not the encoded numbers. They do this in reverse 
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order: first C, last A. If it turns out that all of them 
chose to do nothing, or all of them chose to perform Uu, 
the run is treated as a valid distribution of the secret 
numbers. 

The protocol distributes the numbers in the required 
way because 



If' 



II 



1, 



where 1 is the identity matrix, and 

U(k)U(l)U(m) = 1, 



(4) 



(5) 



whenever k + I + m = modulo 3. 

Security. — The traitor general may be eavesdropping 
either by an intercept-resend method or by entangling 
the qutrit with another system. However, any of these 
attacks cause a disturbance which can be detected in a 
random check of some of the valid runs (exchanging the 
actual numbers between the parties). To prove that the 
quantum distribution of the lists is secure against these 
attacks, note that, if there is no eavesdropping, the state 
that the last general receives must be a pure state. Af- 
ter all the generals reveal their bases (in the right time 
order, first C, next B, and finally A), and if the bases 
are the same, then the final state must be an eigenstate 
of the final measurement basis, namely \ipo). Therefore, 
the measurement results should be perfectly determinis- 
tic because the state of the qutrit is pure at any step of 
the protocol. However, any eavesdropping by the traitor 
general, which is about to give him information about 
the state of the qutrit, as it is done before the bases are 
revealed, must lead to correlations with classical (e.g., 
in the intercept-resend strategy) or quantum (e.g., when 
entangling the qutrit with an ancilla) states of some sys- 
tems monitored by the traitor. That is, the effective state 
(averaged over the selected runs in which all the gener- 
als claim that they set the same basis) reaching the final 
measurement station is a mixed state. There does not 
exist any observable for which a mixed state gives a de- 
terministic prediction. 

In the protocol parts of the lists must be revealed for 
the cross-check for eavesdropping or cheating. If one re- 
quires that the order of revealing the numbers is random, 
then the traitor will not be the last one to announce his 
value in approximately 2/3 of cases. In such cases, the 
traitor has no way to announce a number which is always 
consistent. Thus from the analysis of the errors, the loyal 
generals can conclude that there was cheating. Note that, 
paradoxically, in order not to be uncovered in those cases 
when the traitor is chosen to be the last one to declare his 
number, he must give, from time to time, an inconsistent 
number (i.e., not fulfilling the (k + I + m) mo d3 = rule). 
Otherwise, the set of cases in which he reveals last would 
look suspiciously perfect. 

Furthermore, note that C could also cheat when an- 
nouncing in which runs he received measurements consis- 
tent with \ipo)- But then, the cheating is easily detectable 



after the bases are revealed, since only valid runs deter- 
ministically lead to |-0o) - This is because Ufj ^ 1, etc. 

After this protocol, each of the parties has a final list. 
If all the results are correctly correlated, the generals 
would assume that the remaining results are correctly 
correlated and will use the resulting lists I a, Ib and lc 
to reach an agreement, as we explained before. In case 
of failure of this part, the loyal generals agree to abort. 

Possible experimental implementations. — The single 
qutrit required for the protocol can be realized in many 
ways. One of them would be by means of the unbi- 
ased multiport beamsplitters [3]. Other possibility is 
time-bin 1J| realization of qutrits. Furthermore, one can 
use type-II spontaneous parametric down-conversion and 
treat the three symmetric two-photon polarization states 
as the basis state of a composite qutrit [Hj]. Finally, an- 
other possibility is using single photons passing trough a 
triple slit (ljj . 

Advantages over QKD protocols. — The single-qutrit 
scheme has two main advantages versus the the scheme 
in |ll|: 

(i) The scheme in consists of two QKD channels. 
Each of them requires the preparation and the measure- 
ment of qubits. Therefore, a successful distribution of 
one number of the lists requires at least two detections. 
Indeed, it requires four detections if the QKD is based 
on von Neumann measurements on a single qubit, since 
each QKD channel must transmit a trit value. If the effi- 
ciency of the detectors r\ is not perfect, then a successful 
distribution occurs with only probability rj 2 (more real- 
istically, only with probability rf"). In the single-qutrit 
scheme a successful distribution occurs with probability 
r\. The single qutrit method scales much more efficiently 
with a growing number of generals. This makes such a 
scheme even more favorable. 

(ii) The goal of the scheme in [Tljj is to distribute lists of 
six combinations of numbers (0-1-2, 0-2-1, 1-0-2, 1-2-0, 
2-0-1, and 2-1-0). The goal of the single-qutrit scheme 
is to distribute simpler lists with a different symmetry; 
lists of four combinations of numbers (0-0-0, 1-1-1, 2-0- 
1, and 2-1-0). The classical part of single-qutrit scheme 



is therefore more efficient than that of the scheme in [11 1. 

Conclusions. — Single qutrits allow QKD protocols 
with additional security features 13, LL8[ , quantum ran- 
dom number generation [lj|, and better-than-classical 
performance in games which require entanglement when 
they are played with two qubits [2fj. Here we have pre- 
sented the first application of single qutrits, which pro- 
vides an optimal quantum solution to a multiparty com- 
munication problem. All these results suggest that the 
qutrit provides a very specific quantum resource which is 
positioned between the simplest quantum superposition, 
represented by the qubit, and the simplest form of en- 
tanglement, represented by the two-qubit entanglement. 
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